servo / servo

Servo, the embeddable, independent, memory-safe, modular, parallel web rendering engine
https://servo.org
Mozilla Public License 2.0
28.35k stars 3.03k forks source link

Layout crash loading https://wallhaven.cc/w/7pzj1y #33961

Closed webbeef closed 1 week ago

webbeef commented 1 week ago

To Reproduce: Load https://wallhaven.cc/w/7pzj1y

Expected: page loads properly

Observed: crash with the following info:

attempt to multiply with overflow (thread Script(1,1), at components/layout_2020/replaced.rs:621)

The values are:

max_inline_size=42408 block_size=172800 max_block_size=36389 inline_size=307200

This is indeed overflowing the range of a Au which is an i32. Casting the values on line 621 to i64 prevents the crash, but is that appropriate?

Platform: Tested on Linux Ubuntu 24.10

Loirooriol commented 1 week ago

The logic is wrong anyways, because it assumes that the aspect ratio applies to the content box, e.g.

<style>canvas { max-width: 50px; max-height: 50px; aspect-ratio: 1 / 1; box-sizing: border-box; border: solid; }</style>
<canvas style="border-width: 0 50px"></canvas>
<canvas style="border-width: 50px 0"></canvas>
Servo Blink